Spacebar Server had a missing authorization flaw that allows any authenticated user to add themselves to arbitrary group direct message channels by sending a PUT request to /channels/{channel_id}/recipients/{user_id}. This enables the attacker to read the full message history, post messages as a participant, and force‑add other users without their consent, effectively bypassing access controls and compromising confidentiality and integrity of private conversations.

All deployed versions of Spacebar Server before the commit dcfd91035e3da42abf5f32d8d86a35219225b3d4 are vulnerable. The affected component is the channels recipient endpoint of the server’s API.

The CVSS score of 8.6 indicates high severity. The EPSS score is not available, but the nature of the vulnerability—missing authorization on an authenticated API endpoint—suggests that it can be exploited by any user with legitimate credentials. The vulnerability is not listed in CISA’s KEV catalog, but its high CVSS and wide impact scope mean it should be treated as a critical issue if left unpatched.